Skip to main content

WamiContext

wami

Struct WamiContext 

Source 
pub struct WamiContext { /* private fields */ }
Expand description

WAMI Context - carries authentication and authorization information

This context is created during authentication and passed to all service operations. It contains information about who is performing the operation and where it should be executed.

Implementations§

Source§

impl WamiContext

Source

pub fn builder() -> WamiContextBuilder

Create a new context builder

Examples found in repository?
examples/18_session_tokens.rs (line 28)
22async fn main() -> Result<(), Box<dyn std::error::Error>> {
23    println!("=== Session Tokens ===\n");
24
25    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
26
27    // Create context
28    let context = WamiContext::builder()
29        .instance_id("123456789012")
30        .tenant_path(TenantPath::single(0))
31        .caller_arn(
32            WamiArn::builder()
33                .service(wami::arn::Service::Iam)
34                .tenant_path(TenantPath::single(0))
35                .wami_instance("123456789012")
36                .resource("user", "admin")
37                .build()?,
38        )
39        .is_root(false)
40        .build()?;
41
42    // Create user
43    let user_service = UserService::new(store.clone());
44    let alice_req = CreateUserRequest {
45        user_name: "alice".to_string(),
46        path: Some("/".to_string()),
47        permissions_boundary: None,
48        tags: None,
49    };
50    let alice = user_service.create_user(&context, alice_req).await?;
51    println!("Step 1: Created user alice");
52    println!("  ARN: {}\n", alice.arn);
53
54    // Generate session token
55    let sts_service = SessionTokenService::new(store.clone());
56
57    let token_req = GetSessionTokenRequest {
58        duration_seconds: Some(3600),
59        serial_number: None,
60        token_code: None,
61    };
62
63    let response = sts_service
64        .get_session_token(&context, token_req, &alice.arn)
65        .await?;
66
67    println!("Step 2: Generated session token");
68    println!("  Access Key: {}", response.credentials.access_key_id);
69    println!(
70        "  Secret Key: {}...",
71        &response.credentials.secret_access_key[..20]
72    );
73    println!(
74        "  Session Token: {}...",
75        &response.credentials.session_token[..30]
76    );
77    println!("  Expiration: {}", response.credentials.expiration);
78
79    println!("\n✅ Example completed successfully!");
80    println!("Key takeaways:");
81    println!("- Session tokens provide temporary credentials");
82    println!("- Credentials expire after specified duration");
83    println!("- Useful for temporary or delegated access");
84
85    Ok(())
86}
More examples
Hide additional examples
examples/20_federated_access.rs (line 28)
22async fn main() -> Result<(), Box<dyn std::error::Error>> {
23    println!("=== Federated Access ===\n");
24
25    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
26
27    // Create context
28    let context = WamiContext::builder()
29        .instance_id("123456789012")
30        .tenant_path(TenantPath::single(0))
31        .caller_arn(
32            WamiArn::builder()
33                .service(wami::arn::Service::Iam)
34                .tenant_path(TenantPath::single(0))
35                .wami_instance("123456789012")
36                .resource("user", "admin")
37                .build()?,
38        )
39        .is_root(false)
40        .build()?;
41
42    // Create admin user who will generate federation tokens
43    let user_service = UserService::new(store.clone());
44    let admin = user_service
45        .create_user(
46            &context,
47            CreateUserRequest {
48                user_name: "admin".to_string(),
49                path: Some("/".to_string()),
50                permissions_boundary: None,
51                tags: None,
52            },
53        )
54        .await?;
55
56    let fed_service = FederationService::new(store.clone());
57
58    println!("Step 1: Generating federation token for external user...\n");
59
60    let fed_req = GetFederationTokenRequest {
61        name: "partner-user".to_string(),
62        duration_seconds: Some(3600),
63        policy: Some(r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}"#.to_string()),
64    };
65
66    let response = fed_service
67        .get_federation_token(&context, fed_req, &admin.arn)
68        .await?;
69
70    println!("✓ Generated federation token:");
71    println!("  Federated User ARN: {}", response.federated_user.arn);
72    println!("  Access Key: {}", response.credentials.access_key_id);
73    println!("  Expiration: {}", response.credentials.expiration);
74
75    println!("\n✅ Example completed successfully!");
76    println!("Key takeaways:");
77    println!("- Federation enables external user access");
78    println!("- Temporary credentials with limited permissions");
79    println!("- Useful for partner integrations");
80
81    Ok(())
82}
examples/01_hello_wami.rs (line 29)
19async fn main() -> Result<(), Box<dyn std::error::Error>> {
20    println!("=== Hello WAMI ===\n");
21
22    // Step 1: Initialize the store
23    println!("Step 1: Initializing in-memory store...");
24    let mut store = InMemoryWamiStore::default();
25    println!("✓ Store initialized");
26
27    // Step 2: Create a WamiContext for operations
28    println!("\nStep 2: Creating WAMI context...");
29    let context = WamiContext::builder()
30        .instance_id("123456789012")
31        .tenant_path(TenantPath::single(0)) // Root tenant ID is 0
32        .caller_arn(
33            WamiArn::builder()
34                .service(wami::arn::Service::Iam)
35                .tenant_path(TenantPath::single(0))
36                .wami_instance("123456789012")
37                .resource("user", "admin")
38                .build()?,
39        )
40        .is_root(false)
41        .build()?;
42    println!("✓ Context created");
43
44    // Step 3: Build a user using pure functions
45    println!("\nStep 3: Building user 'alice'...");
46    let user = build_user("alice".to_string(), Some("/".to_string()), &context)?;
47    println!("✓ User built with ARN: {}", user.wami_arn);
48
49    // Step 4: Store the user
50    println!("\nStep 4: Storing user in the store...");
51    let created_user = store.create_user(user).await?;
52    println!("✓ User stored successfully");
53    println!("  - Name: {}", created_user.user_name);
54    println!("  - User ID: {}", created_user.user_id);
55    println!("  - ARN: {}", created_user.wami_arn);
56
57    // Step 5: Retrieve the user
58    println!("\nStep 5: Retrieving user from store...");
59    let retrieved = store.get_user("alice").await?;
60    match retrieved {
61        Some(user) => {
62            println!("✓ User retrieved successfully");
63            println!("  - Name: {}", user.user_name);
64            println!("  - Path: {}", user.path);
65        }
66        None => println!("✗ User not found"),
67    }
68
69    println!("\n✅ Example completed successfully!");
70    println!("Key takeaways:");
71    println!("- InMemoryWamiStore provides a simple storage backend");
72    println!("- Providers (AWS, GCP, Azure) handle platform-specific details");
73    println!("- Pure functions create domain objects without side effects");
74
75    Ok(())
76}
examples/15_policy_evaluation_simulation.rs (line 28)
22async fn main() -> Result<(), Box<dyn std::error::Error>> {
23    println!("=== Policy Evaluation Simulation ===\n");
24
25    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
26
27    // Create context
28    let context = WamiContext::builder()
29        .instance_id("123456789012")
30        .tenant_path(TenantPath::single(0))
31        .caller_arn(
32            WamiArn::builder()
33                .service(wami::arn::Service::Iam)
34                .tenant_path(TenantPath::single(0))
35                .wami_instance("123456789012")
36                .resource("user", "admin")
37                .build()?,
38        )
39        .is_root(false)
40        .build()?;
41
42    let eval_service = EvaluationService::new(store.clone(), "123456789012".to_string());
43    let user_service = UserService::new(store.clone());
44
45    // Create user
46    println!("Step 1: Creating user...\n");
47    let req = CreateUserRequest {
48        user_name: "alice".to_string(),
49        path: Some("/".to_string()),
50        permissions_boundary: None,
51        tags: None,
52    };
53    let alice = user_service.create_user(&context, req).await?;
54    println!("✓ Created alice: {}", alice.arn);
55
56    // === SIMULATE POLICY ===
57    println!("\n\nStep 2: Simulating custom policy...\n");
58
59    let policy_doc = r#"{
60  "Version": "2012-10-17",
61  "Statement": [{
62    "Effect": "Allow",
63    "Action": ["s3:GetObject", "s3:PutObject"],
64    "Resource": "arn:aws:s3:::my-bucket/*"
65  }]
66}"#;
67
68    // Test allowed action
69    let sim_req = SimulateCustomPolicyRequest {
70        policy_input_list: vec![policy_doc.to_string()],
71        action_names: vec!["s3:GetObject".to_string()],
72        resource_arns: Some(vec!["arn:aws:s3:::my-bucket/file.txt".to_string()]),
73        context_entries: None,
74    };
75
76    let result = eval_service.simulate_custom_policy(sim_req).await?;
77    println!("✓ Simulation: s3:GetObject on my-bucket/file.txt");
78    println!("  Decision: {}", result.evaluation_results[0].eval_decision);
79
80    // Test denied action
81    let denied_req = SimulateCustomPolicyRequest {
82        policy_input_list: vec![policy_doc.to_string()],
83        action_names: vec!["s3:DeleteObject".to_string()],
84        resource_arns: Some(vec!["arn:aws:s3:::my-bucket/file.txt".to_string()]),
85        context_entries: None,
86    };
87
88    let denied_result = eval_service.simulate_custom_policy(denied_req).await?;
89    println!("\n✓ Simulation: s3:DeleteObject on my-bucket/file.txt");
90    println!(
91        "  Decision: {}",
92        denied_result.evaluation_results[0].eval_decision
93    );
94
95    println!("\n✅ Example completed successfully!");
96    println!("Key takeaways:");
97    println!("- Policy simulation helps test before deployment");
98    println!("- Simulate custom policies or principal policies");
99    println!("- Understand allow/deny decisions");
100    println!("- Identify missing permissions");
101
102    Ok(())
103}
examples/19_role_assumption_workflow.rs (line 29)
23async fn main() -> Result<(), Box<dyn std::error::Error>> {
24    println!("=== Role Assumption Workflow ===\n");
25
26    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
27
28    // Create context
29    let context = WamiContext::builder()
30        .instance_id("123456789012")
31        .tenant_path(TenantPath::single(0))
32        .caller_arn(
33            WamiArn::builder()
34                .service(wami::arn::Service::Iam)
35                .tenant_path(TenantPath::single(0))
36                .wami_instance("123456789012")
37                .resource("user", "admin")
38                .build()?,
39        )
40        .is_root(false)
41        .build()?;
42
43    let user_service = UserService::new(store.clone());
44    let role_service = RoleService::new(store.clone());
45    let sts_service = AssumeRoleService::new(store.clone());
46
47    // Create user
48    println!("Step 1: Creating user...\n");
49    let alice = user_service
50        .create_user(
51            &context,
52            CreateUserRequest {
53                user_name: "alice".to_string(),
54                path: Some("/".to_string()),
55                permissions_boundary: None,
56                tags: None,
57            },
58        )
59        .await?;
60    println!("✓ Created alice: {}", alice.arn);
61
62    // Create elevated role
63    println!("\nStep 2: Creating admin role...\n");
64    let trust_policy = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#;
65    let role = role_service
66        .create_role(
67            &context,
68            CreateRoleRequest {
69                role_name: "AdminRole".to_string(),
70                path: Some("/".to_string()),
71                assume_role_policy_document: trust_policy.to_string(),
72                description: Some("Admin role for elevated access".to_string()),
73                max_session_duration: Some(3600),
74                permissions_boundary: None,
75                tags: None,
76            },
77        )
78        .await?;
79    println!("✓ Created AdminRole: {}", role.arn);
80
81    // Assume role
82    println!("\nStep 3: Alice assuming AdminRole...\n");
83    let assume_req = AssumeRoleRequest {
84        role_arn: role.arn.clone(),
85        role_session_name: "alice-admin-session".to_string(),
86        duration_seconds: Some(3600),
87        external_id: None,
88        policy: None,
89    };
90
91    let response = sts_service
92        .assume_role(&context, assume_req, &alice.arn)
93        .await?;
94    println!("✓ Successfully assumed role!");
95    println!("  Assumed Role ARN: {}", response.assumed_role_user.arn);
96    println!("  Access Key: {}", response.credentials.access_key_id);
97    println!("  Expiration: {}", response.credentials.expiration);
98
99    println!("\n✅ Example completed successfully!");
100    println!("Key takeaways:");
101    println!("- AssumeRole provides temporary elevated permissions");
102    println!("- Trust policies control who can assume roles");
103    println!("- Session credentials expire automatically");
104
105    Ok(())
106}
examples/09_multi_cloud_user_sync.rs (line 27)
21async fn main() -> Result<(), Box<dyn std::error::Error>> {
22    println!("=== Multi-Cloud User Sync ===\n");
23
24    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
25
26    // Create context for operations
27    let context = WamiContext::builder()
28        .instance_id("123456789012")
29        .tenant_path(TenantPath::single(0))
30        .caller_arn(
31            WamiArn::builder()
32                .service(wami::arn::Service::Iam)
33                .tenant_path(TenantPath::single(0))
34                .wami_instance("123456789012")
35                .resource("user", "admin")
36                .build()?,
37        )
38        .is_root(false)
39        .build()?;
40
41    println!("✓ Using unified context for all operations");
42
43    // === CREATE USER ===
44    println!("\n\nStep 1: Creating alice user...\n");
45
46    let user_service = UserService::new(store.clone());
47
48    let user_req = CreateUserRequest {
49        user_name: "alice".to_string(),
50        path: Some("/cloud-sync/".to_string()),
51        permissions_boundary: None,
52        tags: Some(vec![
53            wami::types::Tag {
54                key: "Email".to_string(),
55                value: "alice@company.com".to_string(),
56            },
57            wami::types::Tag {
58                key: "MultiCloud".to_string(),
59                value: "true".to_string(),
60            },
61        ]),
62    };
63
64    let user = user_service.create_user(&context, user_req).await?;
65    println!("✓ Created alice:");
66    println!("  - ARN: {}", user.arn);
67    println!("  - User ID: {}", user.user_id);
68    println!("  - WAMI ARN: {}", user.wami_arn);
69
70    // === COMPARE ARN FORMATS ===
71    println!("\n\nStep 2: Understanding WAMI ARN format...\n");
72
73    println!("WAMI unified ARN:");
74    println!("  {}", user.wami_arn);
75    println!("\nThis ARN can be transformed to provider-specific formats:");
76    println!("  - AWS ARN format for AWS API calls");
77    println!("  - GCP resource name format for GCP API calls");
78    println!("  - Azure resource ID format for Azure API calls");
79
80    // === DEMONSTRATE PROVIDER METADATA ===
81    println!("\n\nStep 3: Understanding WAMI architecture...\n");
82
83    println!("WAMI provides:");
84    println!("- Unified WAMI ARN format (for internal operations)");
85    println!("- Provider-specific ARN transformation when needed");
86    println!("- Consistent resource identification across clouds");
87    println!("- Tags for categorization and metadata");
88
89    println!("\nBenefits:");
90    println!("- Unified identity management across clouds");
91    println!("- Provider-agnostic operations with context");
92    println!("- Cross-cloud audit trails with WAMI ARNs");
93    println!("- Multi-cloud resource tracking");
94
95    println!("\n✅ Example completed successfully!");
96    println!("Key takeaways:");
97    println!("- WAMI uses a unified ARN format internally");
98    println!("- Provider-specific ARNs can be generated when needed");
99    println!("- Context-based operations work across all providers");
100    println!("- Use tags to track cross-cloud relationships");
101
102    Ok(())
103}
Additional examples can be found in:
Source

pub fn is_root(&self) -> bool

Check if the caller is a root user

Root users have full access and bypass all authorization checks.

Examples found in repository?
examples/26_secure_instance_bootstrap.rs (line 77)
29async fn main() -> Result<(), Box<dyn std::error::Error>> {
30    println!("🔐 WAMI Secure Instance Bootstrap Example\n");
31    println!("{}", "=".repeat(60));
32
33    // =========================================================================
34    // Step 1: Initialize the Store
35    // =========================================================================
36    println!("\n📦 Step 1: Initialize Store");
37    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
38    println!("✅ In-memory store created");
39
40    // =========================================================================
41    // Step 2: Bootstrap Instance with Root User & Credentials
42    // =========================================================================
43    println!("\n🚀 Step 2: Bootstrap Instance");
44    println!("    Creating instance '999888777' with root user...");
45
46    let instance_id = "999888777";
47    let root_creds = InstanceBootstrap::initialize_instance(store.clone(), instance_id).await?;
48
49    println!("\n✅ Instance initialized successfully!");
50    println!("\n🔑 ROOT CREDENTIALS (SAVE THESE SECURELY!):");
51    println!("{}", "=".repeat(60));
52    println!("   Access Key ID:     {}", root_creds.access_key_id);
53    println!("   Secret Access Key: {}", root_creds.secret_access_key);
54    println!("   Instance ID:       {}", root_creds.instance_id);
55    println!("   User ARN:          {}", root_creds.user_arn);
56    println!("{}", "=".repeat(60));
57    println!("\n⚠️  CRITICAL: These credentials are shown ONLY ONCE!");
58    println!("⚠️  Save them in a secure location (secrets manager, vault, etc.)");
59    println!("⚠️  They CANNOT be retrieved later!");
60
61    // =========================================================================
62    // Step 3: Authenticate as Root
63    // =========================================================================
64    println!("\n🔓 Step 3: Authenticate as Root");
65    println!("    Using access key authentication...");
66
67    let auth_service = AuthenticationService::new(store.clone());
68
69    let root_context = auth_service
70        .authenticate(&root_creds.access_key_id, &root_creds.secret_access_key)
71        .await?;
72
73    println!("✅ Authentication successful!");
74    println!("   Authenticated as: {}", root_context.caller_arn());
75    println!("   Instance ID:      {}", root_context.instance_id());
76    println!("   Tenant Path:      {}", root_context.tenant_path());
77    println!("   Is Root:          {}", root_context.is_root());
78
79    // =========================================================================
80    // Step 4: Perform Operations with Authenticated Context
81    // =========================================================================
82    println!("\n👤 Step 4: Create Admin User (as root)");
83
84    // The same store handle that bootstrapped the instance and authenticated
85    // the caller also serves UserService — one lock type, one source of truth.
86    let user_service = UserService::new(store.clone());
87    let admin_user = user_service
88        .create_user(
89            &root_context,
90            CreateUserRequest {
91                user_name: "admin".to_string(),
92                path: Some("/".to_string()),
93                permissions_boundary: None,
94                tags: None,
95            },
96        )
97        .await?;
98
99    println!("✅ Admin user created: {}", admin_user.user_name);
100    println!("   ARN:              {}", admin_user.wami_arn);
101    println!("   Context is required for all operations");
102    println!("   Root context bypasses authorization checks");
103
104    // =========================================================================
105    // Step 5: Demonstrate Security - Invalid Credentials
106    // =========================================================================
107    println!("\n🛡️  Step 5: Demonstrate Security");
108    println!("    Attempting authentication with invalid secret...");
109
110    let result = auth_service
111        .authenticate(&root_creds.access_key_id, "wrong_secret_key")
112        .await;
113
114    match result {
115        Err(AmiError::AccessDenied { .. }) => {
116            println!("✅ Invalid credentials rejected (as expected)");
117            println!("   Brute force attacks are prevented!");
118        }
119        Ok(_) => {
120            println!("❌ ERROR: Invalid credentials should have been rejected!");
121        }
122        Err(e) => {
123            println!("❌ Unexpected error: {:?}", e);
124        }
125    }
126
127    // =========================================================================
128    // Step 6: Demonstrate Instance State Check
129    // =========================================================================
130    println!("\n🔍 Step 6: Check Instance State");
131
132    let is_initialized = InstanceBootstrap::is_initialized(store.clone(), instance_id).await?;
133    println!(
134        "   Instance '{}' initialized: {}",
135        instance_id, is_initialized
136    );
137
138    let other_instance_initialized =
139        InstanceBootstrap::is_initialized(store.clone(), "123456789").await?;
140    println!(
141        "   Instance '123456789' initialized: {}",
142        other_instance_initialized
143    );
144
145    // =========================================================================
146    // Summary
147    // =========================================================================
148    println!("\n📋 SECURITY SUMMARY");
149    println!("{}", "=".repeat(60));
150    println!("✅ Instance requires initialization before use");
151    println!("✅ Root user has cryptographically secure credentials");
152    println!("✅ Credentials are hashed with bcrypt (never plaintext)");
153    println!("✅ Authentication is mandatory for all operations");
154    println!("✅ Invalid credentials are rejected");
155    println!("✅ No way to brute force instance IDs without credentials");
156    println!("{}", "=".repeat(60));
157
158    println!("\n🎯 BEST PRACTICES");
159    println!("{}", "=".repeat(60));
160    println!("1. Store credentials in secrets manager (AWS/Vault/etc.)");
161    println!("2. Never commit credentials to version control");
162    println!("3. Never log plaintext secrets");
163    println!("4. Use root only for initial setup");
164    println!("5. Create admin users with specific policies");
165    println!("6. Rotate credentials regularly");
166    println!("7. Use principle of least privilege");
167    println!("{}", "=".repeat(60));
168
169    println!("\n✅ Example completed successfully!");
170
171    Ok(())
172}
Source

pub fn caller_arn(&self) -> &WamiArn

Get the caller’s ARN

Examples found in repository?
examples/26_secure_instance_bootstrap.rs (line 74)
29async fn main() -> Result<(), Box<dyn std::error::Error>> {
30    println!("🔐 WAMI Secure Instance Bootstrap Example\n");
31    println!("{}", "=".repeat(60));
32
33    // =========================================================================
34    // Step 1: Initialize the Store
35    // =========================================================================
36    println!("\n📦 Step 1: Initialize Store");
37    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
38    println!("✅ In-memory store created");
39
40    // =========================================================================
41    // Step 2: Bootstrap Instance with Root User & Credentials
42    // =========================================================================
43    println!("\n🚀 Step 2: Bootstrap Instance");
44    println!("    Creating instance '999888777' with root user...");
45
46    let instance_id = "999888777";
47    let root_creds = InstanceBootstrap::initialize_instance(store.clone(), instance_id).await?;
48
49    println!("\n✅ Instance initialized successfully!");
50    println!("\n🔑 ROOT CREDENTIALS (SAVE THESE SECURELY!):");
51    println!("{}", "=".repeat(60));
52    println!("   Access Key ID:     {}", root_creds.access_key_id);
53    println!("   Secret Access Key: {}", root_creds.secret_access_key);
54    println!("   Instance ID:       {}", root_creds.instance_id);
55    println!("   User ARN:          {}", root_creds.user_arn);
56    println!("{}", "=".repeat(60));
57    println!("\n⚠️  CRITICAL: These credentials are shown ONLY ONCE!");
58    println!("⚠️  Save them in a secure location (secrets manager, vault, etc.)");
59    println!("⚠️  They CANNOT be retrieved later!");
60
61    // =========================================================================
62    // Step 3: Authenticate as Root
63    // =========================================================================
64    println!("\n🔓 Step 3: Authenticate as Root");
65    println!("    Using access key authentication...");
66
67    let auth_service = AuthenticationService::new(store.clone());
68
69    let root_context = auth_service
70        .authenticate(&root_creds.access_key_id, &root_creds.secret_access_key)
71        .await?;
72
73    println!("✅ Authentication successful!");
74    println!("   Authenticated as: {}", root_context.caller_arn());
75    println!("   Instance ID:      {}", root_context.instance_id());
76    println!("   Tenant Path:      {}", root_context.tenant_path());
77    println!("   Is Root:          {}", root_context.is_root());
78
79    // =========================================================================
80    // Step 4: Perform Operations with Authenticated Context
81    // =========================================================================
82    println!("\n👤 Step 4: Create Admin User (as root)");
83
84    // The same store handle that bootstrapped the instance and authenticated
85    // the caller also serves UserService — one lock type, one source of truth.
86    let user_service = UserService::new(store.clone());
87    let admin_user = user_service
88        .create_user(
89            &root_context,
90            CreateUserRequest {
91                user_name: "admin".to_string(),
92                path: Some("/".to_string()),
93                permissions_boundary: None,
94                tags: None,
95            },
96        )
97        .await?;
98
99    println!("✅ Admin user created: {}", admin_user.user_name);
100    println!("   ARN:              {}", admin_user.wami_arn);
101    println!("   Context is required for all operations");
102    println!("   Root context bypasses authorization checks");
103
104    // =========================================================================
105    // Step 5: Demonstrate Security - Invalid Credentials
106    // =========================================================================
107    println!("\n🛡️  Step 5: Demonstrate Security");
108    println!("    Attempting authentication with invalid secret...");
109
110    let result = auth_service
111        .authenticate(&root_creds.access_key_id, "wrong_secret_key")
112        .await;
113
114    match result {
115        Err(AmiError::AccessDenied { .. }) => {
116            println!("✅ Invalid credentials rejected (as expected)");
117            println!("   Brute force attacks are prevented!");
118        }
119        Ok(_) => {
120            println!("❌ ERROR: Invalid credentials should have been rejected!");
121        }
122        Err(e) => {
123            println!("❌ Unexpected error: {:?}", e);
124        }
125    }
126
127    // =========================================================================
128    // Step 6: Demonstrate Instance State Check
129    // =========================================================================
130    println!("\n🔍 Step 6: Check Instance State");
131
132    let is_initialized = InstanceBootstrap::is_initialized(store.clone(), instance_id).await?;
133    println!(
134        "   Instance '{}' initialized: {}",
135        instance_id, is_initialized
136    );
137
138    let other_instance_initialized =
139        InstanceBootstrap::is_initialized(store.clone(), "123456789").await?;
140    println!(
141        "   Instance '123456789' initialized: {}",
142        other_instance_initialized
143    );
144
145    // =========================================================================
146    // Summary
147    // =========================================================================
148    println!("\n📋 SECURITY SUMMARY");
149    println!("{}", "=".repeat(60));
150    println!("✅ Instance requires initialization before use");
151    println!("✅ Root user has cryptographically secure credentials");
152    println!("✅ Credentials are hashed with bcrypt (never plaintext)");
153    println!("✅ Authentication is mandatory for all operations");
154    println!("✅ Invalid credentials are rejected");
155    println!("✅ No way to brute force instance IDs without credentials");
156    println!("{}", "=".repeat(60));
157
158    println!("\n🎯 BEST PRACTICES");
159    println!("{}", "=".repeat(60));
160    println!("1. Store credentials in secrets manager (AWS/Vault/etc.)");
161    println!("2. Never commit credentials to version control");
162    println!("3. Never log plaintext secrets");
163    println!("4. Use root only for initial setup");
164    println!("5. Create admin users with specific policies");
165    println!("6. Rotate credentials regularly");
166    println!("7. Use principle of least privilege");
167    println!("{}", "=".repeat(60));
168
169    println!("\n✅ Example completed successfully!");
170
171    Ok(())
172}
Source

pub fn provenance(&self) -> &[Step]

How authority reached the current caller, oldest first.

The chain answers “by what route”, which no ARN should: an ARN names a thing, and one that grows a segment per service traversed stops being comparable — policies matching on it would break, and a trailing wildcard added to compensate would swallow segments nobody intended.

Source

pub fn provenance_trail(&self) -> String

The provenance as one string, for an audit log.

The first principal, then one service:type/value segment per hand-off:

arn:wami:iam:12345678:wami:999:user/alice:sts:assumed-role/DataScientist/session1

It exists to be queried. A trail in a text column answers “which requests went through STS then SSO” with LIKE '%:sts:%:sso:%' — one index, no join, no JSON operators. That is the most common question asked of an audit log, and the structured chain answers it poorly.

This is a projection, not a serialisation: it is deliberately lossy, and there is no parser back. Reconstructing a context from it would give something that looks authoritative while having lost the full ARNs — use WamiContext::provenance when the structure is what matters.

Note it is not the caller’s ARN, and must never be used as one. An identifier that grows a segment per service traversed stops comparing equal to itself, and every policy written against it silently stops matching.

Source

pub fn through( &self, principal: WamiArn, via: Transition, ) -> Result<WamiContext, AmiError>

Derive the context that results from authority passing to principal.

One call writes both the new caller and the step recording the move, so the chain cannot end up describing someone other than the caller. The tenant path and instance follow the new principal, exactly as they do when a context is built.

Root is never regained: a context that was not root cannot become root by assuming something, whatever that something is named. It can only be kept, and only by staying on a root principal.

Fails past MAX_PROVENANCE_DEPTH.

Source

pub fn tenant_path(&self) -> &TenantPath

Get the tenant path

Examples found in repository?
examples/26_secure_instance_bootstrap.rs (line 76)
29async fn main() -> Result<(), Box<dyn std::error::Error>> {
30    println!("🔐 WAMI Secure Instance Bootstrap Example\n");
31    println!("{}", "=".repeat(60));
32
33    // =========================================================================
34    // Step 1: Initialize the Store
35    // =========================================================================
36    println!("\n📦 Step 1: Initialize Store");
37    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
38    println!("✅ In-memory store created");
39
40    // =========================================================================
41    // Step 2: Bootstrap Instance with Root User & Credentials
42    // =========================================================================
43    println!("\n🚀 Step 2: Bootstrap Instance");
44    println!("    Creating instance '999888777' with root user...");
45
46    let instance_id = "999888777";
47    let root_creds = InstanceBootstrap::initialize_instance(store.clone(), instance_id).await?;
48
49    println!("\n✅ Instance initialized successfully!");
50    println!("\n🔑 ROOT CREDENTIALS (SAVE THESE SECURELY!):");
51    println!("{}", "=".repeat(60));
52    println!("   Access Key ID:     {}", root_creds.access_key_id);
53    println!("   Secret Access Key: {}", root_creds.secret_access_key);
54    println!("   Instance ID:       {}", root_creds.instance_id);
55    println!("   User ARN:          {}", root_creds.user_arn);
56    println!("{}", "=".repeat(60));
57    println!("\n⚠️  CRITICAL: These credentials are shown ONLY ONCE!");
58    println!("⚠️  Save them in a secure location (secrets manager, vault, etc.)");
59    println!("⚠️  They CANNOT be retrieved later!");
60
61    // =========================================================================
62    // Step 3: Authenticate as Root
63    // =========================================================================
64    println!("\n🔓 Step 3: Authenticate as Root");
65    println!("    Using access key authentication...");
66
67    let auth_service = AuthenticationService::new(store.clone());
68
69    let root_context = auth_service
70        .authenticate(&root_creds.access_key_id, &root_creds.secret_access_key)
71        .await?;
72
73    println!("✅ Authentication successful!");
74    println!("   Authenticated as: {}", root_context.caller_arn());
75    println!("   Instance ID:      {}", root_context.instance_id());
76    println!("   Tenant Path:      {}", root_context.tenant_path());
77    println!("   Is Root:          {}", root_context.is_root());
78
79    // =========================================================================
80    // Step 4: Perform Operations with Authenticated Context
81    // =========================================================================
82    println!("\n👤 Step 4: Create Admin User (as root)");
83
84    // The same store handle that bootstrapped the instance and authenticated
85    // the caller also serves UserService — one lock type, one source of truth.
86    let user_service = UserService::new(store.clone());
87    let admin_user = user_service
88        .create_user(
89            &root_context,
90            CreateUserRequest {
91                user_name: "admin".to_string(),
92                path: Some("/".to_string()),
93                permissions_boundary: None,
94                tags: None,
95            },
96        )
97        .await?;
98
99    println!("✅ Admin user created: {}", admin_user.user_name);
100    println!("   ARN:              {}", admin_user.wami_arn);
101    println!("   Context is required for all operations");
102    println!("   Root context bypasses authorization checks");
103
104    // =========================================================================
105    // Step 5: Demonstrate Security - Invalid Credentials
106    // =========================================================================
107    println!("\n🛡️  Step 5: Demonstrate Security");
108    println!("    Attempting authentication with invalid secret...");
109
110    let result = auth_service
111        .authenticate(&root_creds.access_key_id, "wrong_secret_key")
112        .await;
113
114    match result {
115        Err(AmiError::AccessDenied { .. }) => {
116            println!("✅ Invalid credentials rejected (as expected)");
117            println!("   Brute force attacks are prevented!");
118        }
119        Ok(_) => {
120            println!("❌ ERROR: Invalid credentials should have been rejected!");
121        }
122        Err(e) => {
123            println!("❌ Unexpected error: {:?}", e);
124        }
125    }
126
127    // =========================================================================
128    // Step 6: Demonstrate Instance State Check
129    // =========================================================================
130    println!("\n🔍 Step 6: Check Instance State");
131
132    let is_initialized = InstanceBootstrap::is_initialized(store.clone(), instance_id).await?;
133    println!(
134        "   Instance '{}' initialized: {}",
135        instance_id, is_initialized
136    );
137
138    let other_instance_initialized =
139        InstanceBootstrap::is_initialized(store.clone(), "123456789").await?;
140    println!(
141        "   Instance '123456789' initialized: {}",
142        other_instance_initialized
143    );
144
145    // =========================================================================
146    // Summary
147    // =========================================================================
148    println!("\n📋 SECURITY SUMMARY");
149    println!("{}", "=".repeat(60));
150    println!("✅ Instance requires initialization before use");
151    println!("✅ Root user has cryptographically secure credentials");
152    println!("✅ Credentials are hashed with bcrypt (never plaintext)");
153    println!("✅ Authentication is mandatory for all operations");
154    println!("✅ Invalid credentials are rejected");
155    println!("✅ No way to brute force instance IDs without credentials");
156    println!("{}", "=".repeat(60));
157
158    println!("\n🎯 BEST PRACTICES");
159    println!("{}", "=".repeat(60));
160    println!("1. Store credentials in secrets manager (AWS/Vault/etc.)");
161    println!("2. Never commit credentials to version control");
162    println!("3. Never log plaintext secrets");
163    println!("4. Use root only for initial setup");
164    println!("5. Create admin users with specific policies");
165    println!("6. Rotate credentials regularly");
166    println!("7. Use principle of least privilege");
167    println!("{}", "=".repeat(60));
168
169    println!("\n✅ Example completed successfully!");
170
171    Ok(())
172}
Source

pub fn instance_id(&self) -> &str

Get the instance ID

Examples found in repository?
examples/26_secure_instance_bootstrap.rs (line 75)
29async fn main() -> Result<(), Box<dyn std::error::Error>> {
30    println!("🔐 WAMI Secure Instance Bootstrap Example\n");
31    println!("{}", "=".repeat(60));
32
33    // =========================================================================
34    // Step 1: Initialize the Store
35    // =========================================================================
36    println!("\n📦 Step 1: Initialize Store");
37    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
38    println!("✅ In-memory store created");
39
40    // =========================================================================
41    // Step 2: Bootstrap Instance with Root User & Credentials
42    // =========================================================================
43    println!("\n🚀 Step 2: Bootstrap Instance");
44    println!("    Creating instance '999888777' with root user...");
45
46    let instance_id = "999888777";
47    let root_creds = InstanceBootstrap::initialize_instance(store.clone(), instance_id).await?;
48
49    println!("\n✅ Instance initialized successfully!");
50    println!("\n🔑 ROOT CREDENTIALS (SAVE THESE SECURELY!):");
51    println!("{}", "=".repeat(60));
52    println!("   Access Key ID:     {}", root_creds.access_key_id);
53    println!("   Secret Access Key: {}", root_creds.secret_access_key);
54    println!("   Instance ID:       {}", root_creds.instance_id);
55    println!("   User ARN:          {}", root_creds.user_arn);
56    println!("{}", "=".repeat(60));
57    println!("\n⚠️  CRITICAL: These credentials are shown ONLY ONCE!");
58    println!("⚠️  Save them in a secure location (secrets manager, vault, etc.)");
59    println!("⚠️  They CANNOT be retrieved later!");
60
61    // =========================================================================
62    // Step 3: Authenticate as Root
63    // =========================================================================
64    println!("\n🔓 Step 3: Authenticate as Root");
65    println!("    Using access key authentication...");
66
67    let auth_service = AuthenticationService::new(store.clone());
68
69    let root_context = auth_service
70        .authenticate(&root_creds.access_key_id, &root_creds.secret_access_key)
71        .await?;
72
73    println!("✅ Authentication successful!");
74    println!("   Authenticated as: {}", root_context.caller_arn());
75    println!("   Instance ID:      {}", root_context.instance_id());
76    println!("   Tenant Path:      {}", root_context.tenant_path());
77    println!("   Is Root:          {}", root_context.is_root());
78
79    // =========================================================================
80    // Step 4: Perform Operations with Authenticated Context
81    // =========================================================================
82    println!("\n👤 Step 4: Create Admin User (as root)");
83
84    // The same store handle that bootstrapped the instance and authenticated
85    // the caller also serves UserService — one lock type, one source of truth.
86    let user_service = UserService::new(store.clone());
87    let admin_user = user_service
88        .create_user(
89            &root_context,
90            CreateUserRequest {
91                user_name: "admin".to_string(),
92                path: Some("/".to_string()),
93                permissions_boundary: None,
94                tags: None,
95            },
96        )
97        .await?;
98
99    println!("✅ Admin user created: {}", admin_user.user_name);
100    println!("   ARN:              {}", admin_user.wami_arn);
101    println!("   Context is required for all operations");
102    println!("   Root context bypasses authorization checks");
103
104    // =========================================================================
105    // Step 5: Demonstrate Security - Invalid Credentials
106    // =========================================================================
107    println!("\n🛡️  Step 5: Demonstrate Security");
108    println!("    Attempting authentication with invalid secret...");
109
110    let result = auth_service
111        .authenticate(&root_creds.access_key_id, "wrong_secret_key")
112        .await;
113
114    match result {
115        Err(AmiError::AccessDenied { .. }) => {
116            println!("✅ Invalid credentials rejected (as expected)");
117            println!("   Brute force attacks are prevented!");
118        }
119        Ok(_) => {
120            println!("❌ ERROR: Invalid credentials should have been rejected!");
121        }
122        Err(e) => {
123            println!("❌ Unexpected error: {:?}", e);
124        }
125    }
126
127    // =========================================================================
128    // Step 6: Demonstrate Instance State Check
129    // =========================================================================
130    println!("\n🔍 Step 6: Check Instance State");
131
132    let is_initialized = InstanceBootstrap::is_initialized(store.clone(), instance_id).await?;
133    println!(
134        "   Instance '{}' initialized: {}",
135        instance_id, is_initialized
136    );
137
138    let other_instance_initialized =
139        InstanceBootstrap::is_initialized(store.clone(), "123456789").await?;
140    println!(
141        "   Instance '123456789' initialized: {}",
142        other_instance_initialized
143    );
144
145    // =========================================================================
146    // Summary
147    // =========================================================================
148    println!("\n📋 SECURITY SUMMARY");
149    println!("{}", "=".repeat(60));
150    println!("✅ Instance requires initialization before use");
151    println!("✅ Root user has cryptographically secure credentials");
152    println!("✅ Credentials are hashed with bcrypt (never plaintext)");
153    println!("✅ Authentication is mandatory for all operations");
154    println!("✅ Invalid credentials are rejected");
155    println!("✅ No way to brute force instance IDs without credentials");
156    println!("{}", "=".repeat(60));
157
158    println!("\n🎯 BEST PRACTICES");
159    println!("{}", "=".repeat(60));
160    println!("1. Store credentials in secrets manager (AWS/Vault/etc.)");
161    println!("2. Never commit credentials to version control");
162    println!("3. Never log plaintext secrets");
163    println!("4. Use root only for initial setup");
164    println!("5. Create admin users with specific policies");
165    println!("6. Rotate credentials regularly");
166    println!("7. Use principle of least privilege");
167    println!("{}", "=".repeat(60));
168
169    println!("\n✅ Example completed successfully!");
170
171    Ok(())
172}
Source

pub fn region(&self) -> Option<&str>

Get the default region (if set)

Source

pub fn session_info(&self) -> Option<&SessionInfo>

Get session information (if temporary credentials)

Source

pub fn source_ip(&self) -> Option<&str>

Get the source IP address (if set)

Source

pub fn mfa_present(&self) -> Option<bool>

Check if MFA was used for this request (if known)

Source

pub fn secure_transport(&self) -> Option<bool>

Check if the request uses secure transport (if known)

Source

pub fn can_access_tenant(&self, target_tenant: &TenantPath) -> bool

Check if this context can access a specific tenant path

A context can access:

  • Its own tenant
  • Any child tenant below it in the hierarchy
  • If root user: any tenant in the instance
Source

pub fn is_expired(&self) -> bool

Check if the session has expired (for temporary credentials)

Trait Implementations§

Source§

impl Clone for WamiContext

Source§

fn clone(&self) -> WamiContext

Returns a duplicate of the value. Read more
1.0.0 (const: unstable) · Source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
Source§

impl Debug for WamiContext

Source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter. Read more
Source§

impl<'de> Deserialize<'de> for WamiContext

Source§

fn deserialize<__D>( __deserializer: __D, ) -> Result<WamiContext, <__D as Deserializer<'de>>::Error>
where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer. Read more
Source§

impl From<&WamiContext> for MatchContext

Build a MatchContext from a WamiContext.

Source§

fn from(ctx: &WamiContext) -> MatchContext

Converts to this type from the input type.
Source§

impl Serialize for WamiContext

Source§

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>
where __S: Serializer,

Serialize this value into the given Serde serializer. Read more
Source§

impl TryFrom<WireContext> for WamiContext

Source§

type Error = AmiError

The type returned in the event of a conversion error.
Source§

fn try_from(wire: WireContext) -> Result<WamiContext, AmiError>

Performs the conversion.

Auto Trait Implementations§

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> CloneToUninit for T
where T: Clone,

Source§

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)
Performs copy-assignment from self to dest. Read more
Source§

impl<T> DeserializeOwned for T
where T: for<'de> Deserialize<'de>,

Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T> Same for T

Source§

type Output = T

Should always be Self
Source§

impl<T> ToOwned for T
where T: Clone,

Source§

type Owned = T

The resulting type after obtaining ownership.
Source§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
Source§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
Source§

impl<V, T> VZip<V> for T
where V: MultiLane<T>,

Source§

fn vzip(self) -> V